Langchain-Chatchat Unauthenticated Remote Code Execution Vulnerability

Langchain-Chatchat through 0.3.1.3 contains an unauthenticated remote code execution vulnerability in its POST /tools/call API endpoint.

The endpoint invokes any registered tool by name without authentication. Because the shell tool is always registered, remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user.

• Affected versions: through 0.3.1.3
• Impact: arbitrary OS command execution as the server user
• In the shipped Docker image, the server user is root